Linux Ethernet Bridging - Oct 2018 - [Bridge] [PATCH 1/1] bridge: remove BR_GROUPFWD_RESTRICTED for arbitrary forwarding of reserved addresses

On Mon, Oct 01, 2018 at 08:32:12PM +0200, Richard Weinberger
wrote:
> Am Montag, 1. Oktober 2018, 20:25:26 CEST schrieb Ido Schimmel:
> > On Mon, Oct 01, 2018 at 08:16:22PM +0200, Richard Weinberger wrote:
> > > Florian,
> > > 
> > > Am Montag, 1. Oktober 2018, 18:24:25 CEST schrieb Florian
Fainelli:
> > > > If all you are doing is forwarding anything, one thing I
experimented
> > > > with before is the following:
> > > > 
> > > > # tc qdisc add dev eth1 handle ffff: ingress
> > > > # tc qdisc add dev eth3 handle ffff: ingress
> > > > # tc filter add dev eth3 parent ffff: u32 \
> > > > > match u32 0 0 \
> > > > > action mirred egress redirect dev eth1
> > > > # tc filter add dev eth1 parent ffff: u32 \
> > > > > match u32 0 0 \
> > > > > action mirred egress redirect dev eth3
> > > > # ifconfig eth3 promisc
> > > > # ifconfig eth1 promisc
> > > > 
> > > > and this works just fine actually, bypassing the bridge
layer entirely.
> > > 
> > > Yeah, mirred is a powerful knife. :-)
> > > 
> > > In my case it is too low level since I utilize the netfilter
functionality of
> > > the bridge layer.
> > 
> > You can use mirred only for the specific packets you care about and
let
> > the rest continue to the bridge.
> 
> This is my plan b, having a u32 classifier that transports STP directly
> to the other interface.
> But IMHO this all is a bit hacky and a "forward anything" bridge
mode
> sounds more natural to me.
But "forwarding STP and PAUSE if the number of slaves is restricted to
2" is a hack. The Linux bridge (like other networking equipment) needs
to conform to standards and to the best of my knowledge what you're
requesting is explicitly forbidden by IEEE standards.

Also, if what you need is "forward anything", then Florian's
suggestion
should work for you.

Am Montag, 1. Oktober 2018, 20:48:21 CEST schrieb Ido
Schimmel:
> > This is my plan b, having a u32 classifier that transports STP
directly
> > to the other interface.
> > But IMHO this all is a bit hacky and a "forward anything"
bridge mode
> > sounds more natural to me.
> 
> But "forwarding STP and PAUSE if the number of slaves is restricted to
> 2" is a hack. The Linux bridge (like other networking equipment) needs
> to conform to standards and to the best of my knowledge what you're
> requesting is explicitly forbidden by IEEE standards.
> 
> Also, if what you need is "forward anything", then Florian's
suggestion
> should work for you.
Agreed, both variants are hacks. Depending on the point of view one might seem
less hacky than the other. :-)

As I said, netfilter is also part of the game. Unless I miss something,
netfilter
won't see any packets if tc-mirred is used.
So the only option is having a bridge and transport STP via tc-mirred
or patching the bridge code (what we do right now).
 
Thanks,
//richard